Juliepr Disable XML-RPC

A minimal WordPress plugin that disables XML-RPC, including pingbacks, and removes the RSD discovery link from the page head.

Requires WordPress 6.5+ and PHP 7.4+.

What it does

• Disables XML-RPC authentication with the xmlrpc_enabled filter.
• Removes all registered XML-RPC methods, including pingbacks.
• Removes the EditURI/RSD discovery link emitted in wp_head.
• Does not change the WordPress REST API.
• Adds no settings screen, database options, or external dependencies.

Requirements

• WordPress 6.0 or later
• PHP 7.4 or later

Installation

1. Download or clone this repository.
2. Place the disable-xml-rpc directory in wp-content/plugins/.
3. Activate Juliepr Disable XML-RPC in Plugins → Installed Plugins.

Compatibility note

XML-RPC clients will no longer work after activation. This may affect older WordPress mobile-app configurations or third-party services that still use XML-RPC. Prefer integrations that support the WordPress REST API.

Translations

The bundled Russian translation is provided as a modern PHP .l10n.php file for WordPress 6.5+; no legacy .mo file is included. The editable source is in languages/juliepr-disable-xmlrpc-ru_RU.po.

Development

The plugin deliberately consists of one PHP file and uses WordPress hooks only. Before releasing a change, run:

php -l disable-xml-rpc.php

If the plugin version changes, also update Stable tag and the changelog in readme.txt.

License

GPL-2.0-or-later